A financially motivated initial access broker tracked as CyberXero used Anthropic Claude Code, plus an open-source pentest agent tied into Cobalt Strike, to run two pipelines at once. The Hacker News reported the SOCRadar findings on 12 October 2026. Confirmed theft covers more than 628,000 records from four Ukrainian organisations.
What happened
SOCRadar found the operation after an open directory on 46.21.250.135 leaked the operator's working files, AI session logs, and stolen data. One automated run scanned 4,708 targets, confirmed access to 429 WordPress admin panels, and dropped 32 web shells in 61 seconds.
The global pipeline hits WordPress and e-commerce flaws, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and a Support Board SQL injection (CVE-2026-4815). A second, manual pipeline targets Ukrainian energy and utilities, including a heating provider in Kharkiv. The actor also hit exposed Redis servers, including two Chinese entities.
When a model refused a task, the operator opened a fresh session framed as an authorised test of their own infrastructure. Some refusals held. The campaign was still running when the directory was found.
Who is affected
- WordPress, Magento, and PrestaShop sites reachable from the internet, especially if they run the plugins named above.
- Hosts with Redis exposed to the internet, where attackers added SSH keys.
- Ukrainian energy and utility operators, who were selected for deeper reconnaissance rather than bulk access sales.
What to do now
Check WordPress for rogue administrators and WSO web shells, and check Redis hosts for unexpected lines in authorized_keys. Patch the named flaws, close Redis to the public internet, and treat any unexplained admin session as a compromise, not a noisy scan.
Source: The Hacker News, reporting SOCRadar research published the week of 12 October 2026. Read the report.
Also on the blog
- Edward Dubrovsky arrested in Pennsylvania extortion case
- Nippon Columbia malware exposed 8.63 million karaoke records
- FortiBleed still holds 86,644 Fortinet device credentials
- Fake Claude ads hide a ClickFix command behind Bing
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.